Similar protocol with proof

[wbl]

While investigating the security of McCallum-Relyea I found epeint.iacr.org/2016/144 which presents a similar protocol with a security proof and integrated with shamir secret sharing.

Migration would solve the issue of proveable security.

[eric-j-ason]

Corrected link: https://eprint.iacr.org/2016/144

[wbl]

There is also 2014/650

[wbl]

https://eprint.iacr.org/2018/733 is the most sophisticated in the series and integrates shamir secret sharing and has stateless servers. Not sure yet which makes the most sense but any of these could potentially work.